CISM Information Security Governance Practice Question
An organization is implementing a security culture measurement program. Which THREE metrics would BEST indicate a positive security culture?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Percentage of employees completing security training
A positive culture is reflected in proactive reporting, low error rates, and high engagement. Near miss reporting, training completion, and low human error incidents are key indicators.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Percentage of employees completing security training
Why this is correct
High completion shows engagement and commitment to security.
- ✓
Incidents caused by human error
Why this is correct
A low number of incidents from human error suggests effective awareness and culture.
- ✗
Time since last security audit
Why it's wrong here
Not a direct measure of culture; audit frequency is a governance process.
- ✓
Near-miss reporting rate
Why this is correct
High near-miss reporting indicates a culture where employees are vigilant and willing to report without fear.
- ✗
Number of security incidents reported to management
Why it's wrong here
High reporting can be good or bad; not specific to culture.
Go deeper
Related to this question
About these practice questions
One of 871 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.